{
	"id": "fb7fda00-59b2-436a-832e-950255dea9bf",
	"created_at": "2026-04-06T00:19:24.829537Z",
	"updated_at": "2026-04-10T03:35:28.949593Z",
	"deleted_at": null,
	"sha1_hash": "d78204dc9c611993bc9403c9c4603c1523edf016",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 50941,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:52:13 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Explosive\n Tool: Explosive\nNames Explosive\nCategory Malware\nType Backdoor, Info stealer\nDescription\n(Check Point) Explosive is implanted within its targets and then used to harvest\ninformation. Tracking down these infections was quite a difficult task due to the\nmultiple concealment measures taken by the attackers. The attackers select only a\nhandful of targets to avoid unnecessary exposure. New and custom versions are\ndeveloped, compiled and deployed specifically for certain targets, and ”radio silence”\nperiods are configured and embedded specifically into each targeted implant.\nInformation MITRE ATT\u0026CK Last change to this tool card: 30 December 2022\nDownload this tool card in JSON format\nAll groups using tool Explosive\nChanged Name Country Observed\nAPT groups\n Volatile Cedar 2012-Early 2020\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6ab0177a-c4d1-4704-a44a-f2959b8c8edf\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6ab0177a-c4d1-4704-a44a-f2959b8c8edf\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6ab0177a-c4d1-4704-a44a-f2959b8c8edf"
	],
	"report_names": [
		"listgroups.cgi?u=6ab0177a-c4d1-4704-a44a-f2959b8c8edf"
	],
	"threat_actors": [
		{
			"id": "42a6a29d-6b98-4fd6-a742-a45a0306c7b0",
			"created_at": "2022-10-25T15:50:23.710403Z",
			"updated_at": "2026-04-10T02:00:05.281246Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"Whisper Spider"
			],
			"source_name": "MITRE:Silence",
			"tools": [
				"Winexe",
				"SDelete"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "bc5c22a8-29eb-4a87-acd6-4817060e80f2",
			"created_at": "2022-10-25T15:50:23.658256Z",
			"updated_at": "2026-04-10T02:00:05.38013Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Volatile Cedar",
				"Lebanese Cedar"
			],
			"source_name": "MITRE:Volatile Cedar",
			"tools": [
				"Caterpillar WebShell"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "17b152bc-6f7e-463c-8b4c-a4844caea6df",
			"created_at": "2023-01-06T13:46:38.498795Z",
			"updated_at": "2026-04-10T02:00:03.000373Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Lebanese Cedar",
				"DeftTorero"
			],
			"source_name": "MISPGALAXY:Volatile Cedar",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "5e7c75c6-097f-4d80-8c98-73485fe2a729",
			"created_at": "2022-10-25T16:07:24.386715Z",
			"updated_at": "2026-04-10T02:00:04.970172Z",
			"deleted_at": null,
			"main_name": "Volatile Cedar",
			"aliases": [
				"Amethyst Rain",
				"Dancing Salome",
				"DeftTorero",
				"G0123",
				"VolcanicTimber"
			],
			"source_name": "ETDA:Volatile Cedar",
			"tools": [
				"ASPXSpy",
				"ASPXTool",
				"Adminer",
				"DirBuster",
				"GoBuster",
				"JuicyPotato",
				"RottenPotato",
				"SharPyShell"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "eb5915d6-49a0-464d-9e4e-e1e2d3d31bc7",
			"created_at": "2025-03-29T02:05:20.764715Z",
			"updated_at": "2026-04-10T02:00:03.851829Z",
			"deleted_at": null,
			"main_name": "GOLD WYMAN",
			"aliases": [
				"Silence "
			],
			"source_name": "Secureworks:GOLD WYMAN",
			"tools": [
				"Silence"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "88e53203-891a-46f8-9ced-81d874a271c4",
			"created_at": "2022-10-25T16:07:24.191982Z",
			"updated_at": "2026-04-10T02:00:04.895327Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"ATK 86",
				"Contract Crew",
				"G0091",
				"TAG-CR8",
				"TEMP.TruthTeller",
				"Whisper Spider"
			],
			"source_name": "ETDA:Silence",
			"tools": [
				"EDA",
				"EmpireDNSAgent",
				"Farse",
				"Ivoke",
				"Kikothac",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Meterpreter",
				"ProxyBot",
				"ReconModule",
				"Silence.Downloader",
				"TiniMet",
				"TinyMet",
				"TrueBot",
				"xfs-disp.exe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434764,
	"ts_updated_at": 1775792128,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d78204dc9c611993bc9403c9c4603c1523edf016.pdf",
		"text": "https://archive.orkl.eu/d78204dc9c611993bc9403c9c4603c1523edf016.txt",
		"img": "https://archive.orkl.eu/d78204dc9c611993bc9403c9c4603c1523edf016.jpg"
	}
}